diff --git a/vars/default_vars.yml b/vars/default_vars.yml
index 5cf2a4e2f..a85099508 100644
--- a/vars/default_vars.yml
+++ b/vars/default_vars.yml
@@ -90,15 +90,19 @@ gui_wan: True
 adm_cons_force_ssl: False
 adm_cons_allow_downloads: False
 
+# Enables "campus access" to kiwix (3000), kalite (8008) & calibre (8010 or
+# 8080) on WAN side of server. See network/templates/gateway/iiab-gen-iptables
+# within github.com/iiab/iiab/blob/master/roles/
+services_externally_visible: True
+
 # Gateway and Filters
-# Most all implementations set "iiab_gateway_enabled: False" within
+# Most all implementations use "iiab_gateway_enabled: False" within
 # local_vars.yml as they cannot afford Internet access for students
 # and teachers, and the many associated IT/support/training costs.
-iiab_gateway_enabled: True
+iiab_gateway_enabled: False
 gw_squid_whitelist: False
 gw_block_https: False
 
-# dhcpd
 dhcpd_install: False
 dhcpd_enabled: False